News Now

CU System

Justice Dept. answers hackers claim he was authorized by feds

BOSTON (1/6/12)--The Justice Department has filed its response to allegations by convicted hacker Albert Gonzalez, who seeks to vacate his 20-year sentence for hacking into TJX Cos., Dave and Buster's, and Heartland Payment Systems with the arguments that he had ineffective counsel and the breaches were authorized by the U.S. Secret Service while he was an informant.

The Justice Department, in its filing on Dec. 6 in the U.S. District Court for the District of Massachusetts, Boston, argues the court should deny Gonzalez's motions without a hearing.

Gonzalez, under a plea agreement, was convicted of some of history's largest data breaches, which occurred between 2003 and 2008. Court documents indicated he "committed computer crimes, identity thefts and wire frauds resulting in the theft of tens of millions of credit and debit card numbers, causing hundreds of millions of dollars in financial losses."

Many accounts compromised belonged to credit union members. Credit unions and members suffered losses from fraud and from the cost of reissuing cards. The cases and similar ones sparked a variety of lawsuits against the companies breached, as well as new laws and regulations designed to protect consumers and financial institutions that bore the brunt of the costs associated with the data breaches.

In November 2009, Gonzalez entered his plea agreements in the three cases, pleading guilty in exchange for shorter and concurrent sentences. He was sentenced to three concurrent sentences that effectively resulted in a sentence of 20 years in prison.

On March 24, 2011, Gonzalez filed petitions to vacate, set aside or correct the sentences, claiming his guilty plea was not knowingly and voluntarily entered, that he received ineffective assistance of counsel related to his plea bargain, and that counsel did not tell him he had a "public authority" defense.

In moving to deny the motions, the Justice Department noted that a "guilty plea may be attacked on collateral review only in 'strictly limited' circumstances," and that "Gonzalez did not seek to set aside his plea in district court, nor did he challenge it on direct appeal."

As to his allegation that he did not know he could have a "public authority" defense and would not have pleaded guilty had he known, the Justice Department said: "Gonzalez's assertion that he believed that his Secret Service handlers had the authority to authorize him, and were authorizing him, to steal over 40 million credit and debit card numbers, sell blocks of victims' numbers through a Ukrainian fence, and bury over $1.1 million of the proceeds in his parents' back yard is inherently incredible."

It noted "Gonzalez admits concealing the crimes to which he pleaded from the Secret Service."

The government said in its brief that Gonzalez failed to satisfy a four-prong test for raising the "public authority defense":

Defendant must be requested to engage in covert activity by a government official;

The official must have actual authority to authorize such covert activity;

The defendant must have relied on the request; and

The reliance must have been reasonable.

The response also noted that Gonzalez waived his right to challenge his conviction and the sentences by knowing and voluntarily pleading guilty.

On Dec. 30, Gonzalez, who is acting as his own attorney from prison, requested a delay in filing his response, noting that the government's brief and 400 pages of records in the case are lengthy and because of limited resources in prison, he needed more time to prepare his reply. The court granted the extension on Wednesday until Jan. 17, according to the court docket.